Is My Computer a Zombie? (and Other Uses for Netstat)

Netstat is a helpful tool for displaying information about current network connections. In this article, Kyle Cassidy and Richard Cardona give you the scoop on Netstat syntax and uses.

Netstat (NETwork STATe) is an old part of the TCP/IP suite of tools.
It's mentioned as far back as 1972, when it was known also as "who is
up." Netstat is used to display not completely related information about
current network connections. It has many implementations, from Unix to Microsoft
Windows, each carrying a subset of the netstat commands.

Netstat is defined in RFC 1147, "The Internet Tool Catalog," as
follows:

...a program that accesses network related data structures within the
kernel, then provides an ASCII format at the terminal. Netstat can provide
reports on the routing table, TCP connections, TCP and UDP "listens,"
and protocol memory management. MECHANISM Netstat accesses operating system
memory to read the kernel routing tables.

Netstat provides this
information for the moment at which one executes the command. That information
might change even as netstat is running.

Netstat Commands and Syntax

Netstat works from a command line and has a variety of switches, as shown in
Table 1.

Table 1 Netstat Command Switches

-a

Displays all connections and listening ports.

-e

Displays Ethernet statistics. May be combined with -s.

-n

Displays addresses and port numbers in numerical form.

-p proto

Displays connections for the protocol specified by proto;
proto may be TCP or UDP. If used with the -s option to display
per-protocol statistics, proto may be TCP, UDP, or IP.

-r

Displays the routing table.

-s

Displays per-protocol statistics. By default, statistics are shown for TCP,
UDP, and IP; The -p option may be used to specify a subset of the
default.